CVE-2016-10752

NONE EPSS 81.6%
Published May 24, 20197y ago · Modified Jun 17, 20262w ago
Find Similar
Published May 24, 2019 7y ago
Last Modified Jun 17, 2026 2w ago

Description

serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.

Threat Intelligence

EPSS Exploit Probability
81.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 1

VendorProductVersionRange
s9yserendipity2.0.3any

References 2

  • blog.ripstech.com https://blog.ripstech.com/2016/serendipity-from-file-upload-to-code-execution/
    Third Party Advisory
  • demo.ripstech.com https://demo.ripstech.com/projects/serendipity_2.0.3
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.